Zimbra flaw CVE-2026-73570 lets attackers steal platform-wide authentication keys

October 4, 2026 at 10:36 AM3 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Attackers exploiting Zimbra vulnerability CVE-2026-73570 harvested the zimbraAuthTokenKey that signs user session tokens platform-wide, enabling permanent identity compromise that survives password resets. The flaw, rated CVSS 8.9, allows unauthenticated OS command injection via SNMP notifications and affects all versions prior to 10.1.20. Microsoft observed scanning tools probing the injection point between July 28 and August 7, 2026, before public disclosure on August 13.

Key Facts

CVE-2026-73570 carries a CVSS score of 8.9 and is an unauthenticated OS command injection flaw in the SNMP notification path of Zimbra Collaboration Suite.
The vulnerability affects all Zimbra versions prior to 10.1.20, which was released on July 20, 2026.
Attackers harvested the zimbraPreAuthKey, zimbraAuthTokenKey, and zimbraTwoFactorAuthSecret, enabling generation of valid session tokens for any account.
CISA added the flaw to its Known Exploited Vulnerabilities catalog on August 21, 2026, setting a federal remediation deadline of August 24.
Microsoft observed out-of-band scanning tools probing the injection point between July 28 and August 7, 2026.

Identity Layer Breach

Harvested authentication secrets — specifically the zimbraPreAuthKey, zimbraAuthTokenKey, and zimbraTwoFactorAuthSecret — have transformed the exploitation of CVE-2026-73570 from a localized email breach into a permanent, platform-wide identity compromise. By obtaining these keys, attackers can generate valid session tokens and pre-authenticated login URLs for any account, effectively bypassing traditional credential-based security and maintaining persistent access to the entire Zimbra environment. The vulnerability, which carries a CVSS score of 8.9, is an unauthenticated OS command injection flaw within the SNMP notification path of Zimbra Collaboration Suite. It requires no user interaction or prior authentication. An attacker can trigger shell command execution as the zimbra service account by sending a crafted SMTP email, provided the optional zimbra-snmp package is installed and SNMP notifications are enabled. This flaw affects all versions prior to 10.1.20, which was released on July 20, 2026.

Exploitation Timeline

The exploitation timeline highlights a critical gap between patch availability and public awareness. Although the patch shipped on July 20, Microsoft observed out-of-band scanning tools probing the injection point between July 28 and August 7. Public disclosure did not arrive until August 13. By August 17, CERT Polska flagged active exploitation, and CISA added the flaw to its Known Exploited Vulnerabilities catalog on August 21, setting a federal remediation deadline of August 24.

Attack Chain

The operation was multi-staged. After initial access via the SNMP notification path, attackers conducted reconnaissance using specific User-Agents to fingerprint the environment. They deployed JSP web shells across Jetty and mailboxd paths with copies on peer nodes for redundancy, established reverse shells, and escalated privileges to root by abusing Zimbra’s legitimate sudo-authorized helpers and PAM configuration. Persistence came through a systemd service disguised as a logging component. Attackers then used the Zimbra SSH identity to move laterally across the cluster, deploying custom malware — the zimdown2 installer and zimclient2 remote-access agent — before staging data for exfiltration to Azure Blob storage.

What the Keys Unlock

The most damaging phase involved the systematic harvesting of centralized service secrets. As Microsoft’s threat intelligence report states: “The actor targeted Zimbra’s centralized service and authentication secrets rather than individual mailbox passwords.” By querying the LDAP directory, attackers retrieved the zimbraPreAuthKey, which allows construction of pre-authenticated login URLs for any user account.